When I started playing around with Linux 25 years ago Debian and APT was a small revolution in how good it worked out of the box.
I tried to get into Red hat and SUSE and I always wanted up in trouble even before I got any Windows manager up and running. Don’t get me started on RPM and dependency hell
Debian just worked. I had stuff up n running BEFORE I had to go down the rabbit hole to understand how all things was connected.
I wish I had known about Debian and apt back then! I spent years distro-hopping because I was so tired of chasing down RPMs in redhat. Like seriously, you can’t just tell me everything you need, and grab all those files at once when I try installing a package?
Ugh. I’ve been a Debian (and derivatives) user since the late '90s, and you’re unlocking memories of what chased me away from Red Hat distros back then.
Debian has a lot of other things going for it - but Slackware still beat it by two months, and Linux wouldn't be the same without it. Worth celebrating! 🎉
I need to look into it again. I wanted to stabilize my footage of a Samsung gear 360 with the embedded gyro data but I didn’t got it to work. Maybe I have to try it again.
Kate for quick edits and note taking works very well
Konsole is my terminal of choice
Teams for Linux because I have to
docker on the command line because there’s no docker desktop for Linux. There is for windows and MacOS tho, although Linux is literally the thing where it runs on the kernel and whose concepts the whole thing is based upon. Fuck them.
Kind of sad to see still lack (for Linux in general) of apps that are often used in companies. E.g. Teams and docker desktop
Teams for Linux sucks and is not maintained anymore. Devs recommend using the web app and this is what I’m using in Chrome, works really well. Otherwise I’m also on Tumbleweed KDE :)
There’s an unofficial cliënt that I’ve used in the past. Works well even on Wayland (where screen sharing can be an issue sometimes): github.com/IsmaelMartinez/teams-for-linux
Indeed this is the description I find on Discover:
Unofficial Microsoft Teams client for Linux using Electron. It uses the Web App and wraps it as a standalone application using Electron.
The advantage compared to teams.microsoft.com (at least when I load it in Firefox), is that it has many more features, since I guess it’s using an “Edge” user agent, which unlocks stuff that is not enabled for FF. For example, I can have 1:1 calls (yeah, I know…) and blur my background or even set a background pic, all things I can’t really do on FF.
On the other hand, screen sharing works unreliably (at least in a Wayland session, X11 is fine). I’ve reported a bug to KDE since I assumed it’s a kwin issue, but I should test it with a gnome wayland live medium as well…
docker on the command line because there’s no docker desktop for Linux. There is for windows and MacOS tho, although Linux is literally the thing where it runs on the kernel and whose concepts the whole thing is based upon. Fuck them.
You could wrap the Docker/podman commands in a Makefile or create bash aliases/functions.
For a personal PC I love it, never had any issues, package selection is great and bleeding edge.
You may raise your eyebrow since this is in contrast with my previous comment, but I’ve rephrased the final sentence since then (I was rather annoyed by the lack of some official apps on Linux, rather than packages for my specific distro. And that’s 100 on Microsoft/Docker).
To be honest I’m not sure TW is the best choice for a workstation because of its rolling nature, but I just recently turned my personal PC into my (also) work PC, therefore I sticked with what I already had.
An LTS kernel would probably be the safest option, but with snapshots out of the box (if you use btrfs), I still feel quite safe right now. If an update should break something crucial for my work, I’d just roll it back.
Transitioning from debian based shouldn’t be hard, zypper is quite intuitive and fast. You also get OBS which is kinda like pacman user packages.
If you need some obscure app which was packaged years ago in binary for Linux, you’ll probably have much more luck with Debian based since apparently .deb is the first package you wanna target.
But it hasn’t happened in a while now that I needed to download such obscure binaries, typically I could find a repackaged version or an alternative app all together, so…
If any of those can be used with docker, I’m sold!
I cannot move to podman because our projects are shared and the rest of me team is on Windows or MacOs and they all use docker desktop. We also use docker compose files.
I have now and I’m loving podman desktop! All I wanted was a quick and easy way to stop/start/delete running compose clusters, and podman desktop detected all my running docker compose containers and displayed them with the familiar tree-like UI with individual or global controls to play/stop or delete.
For what it’s worth, NFS in my experience is also faster. I had a very similar use case (but QNAP instead of Sinology) and switched everything over to NFS and saw performance gain. Little things like previewing IP Camera security footage would feel slow on SMB, but snappier on NFS. I’d gotten over the user thing, but the speed is why I switched.
I did eventually wipe QNAP’s software in favor of stock Debian – but the prevailing wisdom seems to say Sinology’s OS is pretty good.
I can also confirm this being my experience. I probably didn’t tune samba correctly or something, but when browsing my NAS via samba it regularly took ~1 second per folder navigation, whereas NFS was instant. I didn’t care enough to figure out why, so NFS is what I use.
If your Synology NAS supports ssh, might want to check to see if you can use sshfs. I used to use Samba and NFS on my Debian home server, but switched to sshfs a few months ago. File transfers seem a little quicker than with Samba.
Generally yes unless you have specific privacy concerns. It helps developers know what features people are using so they can be prioritized for development and maintenance, issues people encounter, hardware they're running on, etc.
I'm reminded of Firefox removing ALSA support a few years ago because according the their telemetry no one used it. This made all of the people using ALSA very mad - but they all had telemetry disabled so how was Mozilla supposed to know?
Nothing currently can compete with Adobe Photoshop. Unless they port it to linux. It would take open source devs serious time to catch up to Photoshop development. Plus without making millions of dollars for decades, the development of another application of that scale and complexity would be a serious undertaking. That said GIMP as you know is probably the best “alternative”. For me I just dual-boot and use windows for basically Adobe Suite. All other times I use linux. However I learned GIMP a long time ago so I am comfortable using it for what it can do, and I’m probably faster in GIMP than PS. I am not a professional graphic designer etc. though.
GIMP has the closest thing to feature parity. If you’re looking for similarity of UI and workflow, you’re not going to get it. Adobe throws millions of dollars that open-source projects don’t have at streamlining their UI. UI specialists that will work for free are unicorns, so most open-source UIs are designed by volunteer generalist programmers. Which means that said UI gets the job done, but isn’t optimized for the workflow of people who don’t think like the original programmers.
Personally, I might shift the same picture through Darktable, GIMP, Inkscape, and even Scribus, depending on what I was trying to do with it. (Text on a path -> probably Inkscape, then export as PNG and import into GIMP as a layer.) Is that less convenient than performing all the operations in one program? Possibly, but since I don’t like Photoshop’s UI either, I’m willing to give up on “one-stop shopping”.
(So who, for my money, had the best UI? Probably Paint Shop Pro, twenty or so years ago when it still belonged to JASC. Of course, it was a simpler program too, and so had less junk in its interface.)
Fact is, if you’re a pro, you’ve invested years into learning Photoshop’s interface and how to get the best results out of it. You’re in the position of a baseball player who’s decided to start all over again with basketball. Any attempt to transition to other software is going to be really, really frustrating for you, and likely drop your productivity into the toilet for a few months at least. Plus, you’re going to need some features that average users don’t care about, especially if you’re preparing work for print.
I hate to say it, but you may honestly be best off running Photoshop in a VM rather than trying to move to other software, at least until you can set aside a couple of months where you have no urgent projects (if that ever happens).
I hope we see more composable desktop apps in the FOSS space so that we can at least get more UI options for a given backend. Maybe then we can get closer to what users want. The other option more low code options, so users with more domain expertise and build UXs like they want.
Personally, I might shift the same picture through Darktable, GIMP, Inkscape, and even Scribus, depending on what I was trying to do with it. (Text on a path -> probably Inkscape, then export as PNG and import into GIMP as a layer.)
Gotta love this adaptation of the “do one thing and do it well” principle.
Note that having any kind of real authentication with NFS (other than “limiting client machines by IP and then trusting them to report the correct user”, which might be fine for your local network) and also encryption requires Kerberos. It’s not the end of the world to set up (I have it in my local network) but it is more involved than setting up Samba accounts.
The requirement of managing an LDAP or AD directory service just to get some auth for NFS is a dealbreaker for like 99% of people. It’s such a dumb protocol for the average user and was designed with only huge corporate clients in mind.
Just give people a simple password auth or let them exchange private/public keys between the devices that need to connect!
You don’t need LDAP or AD. Kerberos is a separate thing and nowhere near as insane as LDAP. Though it’s right that they are often combined (in AD for example). However, it’s also a purely authentication system, so no permission controls or anything except for kadmin, from what I can tell.
If I’m not forgetting anything, you need to do pretty much 3 things:
either set up some DNS entries for autodiscovery of your kdc, or install a config file on each host (you probably want the config file either way to set the default realm so you don’t have to type it when logging in, but DNS makes it optional)
set up user principals (you need this for samba too)
create a principal for the NFS service
(Apparently you also need host principals for each machine that wants to connect to NFS, but my macbook can log in and mount the NFS share without a host principal, so maybe not. Still looking into that because I do actually want that for non-home-network purposes.)
Kerberos is the simple password authentication if you use it by itself. Sure, it does stuff that isn’t needed in a small home network such as multi-realm support, and they could have probably either built another authentication system for NFS like Samba’s, or make something that could authenticate users via SSH, but there’s probably a reason for that not being added until now. I assume it at least partially has to do with system-wide mounts.
And Kerberos really isn’t that bad. I set it up in under a day and most of that was spent debugging mounting NFS not working (which was finally solved by a reboot of the NFS server, still not sure what that was about >_>).
That is not true. I don’t have matching IDs on my MacBook vs. my Linux server and the only thing it affects is wrong user/group displayed in e.g. ls output (and I kinda feel like that’s idmap not working correctly on the Mac, though I’m also not too familiar with how it should work). If that’s what you mean by “does what you want”, sure, but permissions are handled correctly.
Yes, displaying the wrong user is a symptom of it not enforcing security.
I’m not sure what idmap is. Does it allow the user numbers to be translated per folder?
Consider this setup: Two users on the server, Bob: 1001 and Jane 1002, and they have each been given ownership and exclusive access to separate folders.
Then you mount that to another machine where the user numbers are swapped. In that case, Bob gets Jane’s files and Jane gets Bob’s files.
Or worse, someone else on the network connects to the share with the 1001 user number. Then they get access to all of Bob’s files. This can be prevented by limiting access to the share from a single IP.
Okay sure, if you’re talking about using it without authentication, then all bets are off anyway. IP-based access isn’t secure if you have a malicious/misconfigured device in the same network (and don’t lock your network down specifically to prevent this).
As far as I can tell (i.e. partially infer from behavior since I can’t find detailed documentation), idmap does two things:
Map between local uids/gids and NFS user/group names (NFS v4 users/groups are strings, not integers), both for display purposes on the client (exactly for the ID mismatch problem) and access control on the server (since FS permissions use local IDs)
Map between krb5 principal and NFS user names, for access control on the server
Also, idmap falls back to nobody/nogroup if it can’t map (which is configurable).
For example, my network uses the krb5 realm HOME.DBLSAIKO.NET. My user saiko has three parts, the local user saiko (with uid 1000 on NFS server and my desktop, but not the MacBook), the principal [email protected] and the nfs user string [email protected] which is automatically inferred from the two other names.
In a directory listing, the nfs server reads the directory, idmap converts the stored uid 1000 to [email protected] and sends that to the client, the client converts that back to uid 1000 to display in an ls listing or whatever.
When the client tries to access a file, the security ticket it sends with the request is for [email protected], which the server maps to uid 1000 and checks the permissions on the file system. So for security, the only thing that matters is that idmap correctly works on the server but is independent of client uids.
As a result, the displayed permissions and the actually enforced permissions are independent from one another since they map to two different things. That’s why on my MacBook, even though my user has id 501 and for some reason idmap doesn’t work so it shows my directory on the NFS share being owned by “1000 _lpoperator” instead of “saiko users”, I can still access it because I have the correct security ticket. (And conversely, if I get a security ticket for a different principal while logged in as saiko with working clientside idmap, the nfs share looks like I could access it according to displayed permissions but I get a permission denied error.)
Note that idmap can also work without authentication, but has to be explicitly enabled on the nfs/nfsd kernel module or in /sys. I assume then, instead of the security ticket, the client sends the nfs username with each request and that’s what it checks against.
Thanks for the detailed reply. I’ve seen mentions of authentication over the years, but the conclusion from every thread like this was that it was nearly impossible to setup.
Yeah, from a complexity perspective it really isn’t a big deal if you just want a basic user/pass authentication setup without any other access controls, which is completely fine for a home network. You can run a single kdc on the same server as nfs, it doesn’t use a lot of resources, and there’s plenty of basic setup guides. And then once you have it, it could also be used to authenticate a bunch of other stuff like SSH, or ironically also for Samba in case you do need it for something that can’t do nfs (e.g. a phone). I’ve yet to try those though.
EDIT: No, you can’t use it for Samba, you need an AD domain apparently. Thanks Microsoft.
I’m not sure why everyone says it’s such a complex thing to set up, maybe the problem is rather more in-depth documentation, since it’s lacking and you often find conflicting and sometimes just plain wrong information.
For example, I’m still not sure why my MacBook can mount the NFS share without a host key despite everything I’ve read suggesting that one is necessary. Maybe to actually limit what computers can log in to krb5 I need to set up pkinit (which requires a PKI)? I can’t find answers and I’ve searched for a while now. Might be time to ask on the mailing list…
linux
Hot
This magazine is from a federated server and may be incomplete. Browse more on the original instance.